summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChristoph Lameter <cl@linux.com>2013-01-23 21:45:47 +0000
committerPekka Enberg <penberg@kernel.org>2013-04-05 14:23:05 +0300
commit4d7868e6475d478172581828021bd8a356726679 (patch)
treef8144ea29586a3f50278936c4a8a5ab02a61636c
parent338b2642290ef3193229ece8cfc776ac4fe8869d (diff)
downloadlinux-4d7868e6475d478172581828021bd8a356726679.tar.gz
linux-4d7868e6475d478172581828021bd8a356726679.tar.bz2
linux-4d7868e6475d478172581828021bd8a356726679.zip
slub: Do not dereference NULL pointer in node_match
The variables accessed in slab_alloc are volatile and therefore the page pointer passed to node_match can be NULL. The processing of data in slab_alloc is tentative until either the cmpxhchg succeeds or the __slab_alloc slowpath is invoked. Both are able to perform the same allocation from the freelist. Check for the NULL pointer in node_match. A false positive will lead to a retry of the loop in __slab_alloc. Signed-off-by: Christoph Lameter <cl@linux.com> Signed-off-by: Pekka Enberg <penberg@kernel.org>
-rw-r--r--mm/slub.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/mm/slub.c b/mm/slub.c
index 21b3f004f614..8b1b99d399cb 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2042,7 +2042,7 @@ static void flush_all(struct kmem_cache *s)
static inline int node_match(struct page *page, int node)
{
#ifdef CONFIG_NUMA
- if (node != NUMA_NO_NODE && page_to_nid(page) != node)
+ if (!page || (node != NUMA_NO_NODE && page_to_nid(page) != node))
return 0;
#endif
return 1;